• State Suggested Answer
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 12 subscribers
  • Views 1240 views
  • Users 0 members are here
Options
Related

Unable to deploy a newly created winplatform. "Access denied invalid credentials"

Jakob Agustsson

Hi everyone,

version SP 2023.R2

I am having trouble deploying a new winplatform to a freshly installed VM. (Windows Server 2022 Standard, OS build 20348.1787)

the error message in the deploy window is the following

Optimizing the galaxy database...
Validating connected galaxy...
Validating GRNodeInfo...
Checking whether objects being deployed require software upgrade...
Sorting and Validating 1 object(s) starting from SCADAS1 hosted by platform SCADAS1 for deploy operation
Deploying 1 Platform(s) starting with SCADAS1 hosted by HS
Error: Failed to deploy SCADAS1 : Access denied, invalid credentials
[WARNING] Deploy Completed: Deployed 0 object(s) out of a total 1 selected object(s) starting with SCADAS1 hosted by HS.

I found a support article, "no 000033888 - Unable to deploy platform : Access Denied - Invalid credentials" text within it is short: ISSUE:  Unable to deploy platform : Access Denied - Invalid credentials - CAUSE: Microsoft Security Update KB500442 is installed.

it refers to another support article for solution namely 000032813.

RESOLUTION: Resolved with Tech Alert TA000032813 System Platform issues with Microsoft Update KB5004442

The title on that one is:  000032813. - System Platform and related products issues with Microsoft Update KB5004442 - DCOM Hardening

in my case the relevant information i believe is that there are no known issues IF the following criteria is met:

      • All Microsoft updates related to DCOM hardening, which include Security-only updates and Monthly Rollup updates, up to and including those released in January 2023, have been applied to all nodes in the system. 

NOTE: It is not supported for systems to run with some of these updates, but not all, nor to run with a mismatch in monthly updates between nodes in the same system.

 This article seems to still be in development, "This article will be updated again in the weeks ahead as research continues. Please continue testing the DCOM setting on your systems in non-production environments only."

I am 99% sure The IT department of my customer has installed all the relevant MS updates, I have requested information from them, but not being able to refer to exactly which updates need to be installed could complicate things, before I go further into this rabbit hole, is there anyone here that knows something about this and maybe has an idea of solution which is simple and has nothing to do with this?

Summary:

Could there be another reason for this issue (with hopefully a simpler solution) and if so does anybody here know anything more?

Is there a proper list of all the MS updates that need to be installed and if so does anyone have that info?

Since this article is supposed to be still in development is there anyone that has any new info?

thanks everyone!

regards

Jakob

attachments: both support articles and 2x screenshots from log and deploy window IDE

PDFPDF

Parents
  • 0

    Hi Jakob,

    I struggled a lot with this error in several different situations using different versions of Application Server..

    What I found out is the same as you've already done, -> The DCOM Hardening updates causes this.

    If all the new VM's are fully (or at least recently) updated, I would think that the most likely cause of your error is missing security updates on the GR/IDE/Development node.

    Both the "host" and the respective "clients" must have the latest security updates installed in order for deployment to work. If your GR/IDE node is in production, it may be difficult to achieve. Then, If you decide to update the GR, you must also update all the other clients in the existing production network in order to maintain stability.

    To confirm that the mismatch in security-updates is the reason, you may check Windows Event Viewer and look for DCOM warnings described  here: support.microsoft.com/.../kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

  • 0 in reply to Jakob Tislevoll

    Hi Jakob!

    Thank you so much for your reply, it is good to know that this is the most likely cause. I am waiting for feedback from the IT department.

    The GR/IDE node is also a new VM, so in total three new VM's

    GR node + IDE the default (black) winplatform is deployed there and functioning ok.

    AOS node 1 (primary) trying to deploy a winplatform there and not succeeding

    AOS node 2 (redundant)  - trying to deploy a winplatform there and not succeeding

    and the GR is not in production so no problem there.

    I will check if there is a mismatch. I also noticed there is a newly issued patch for 23R2, (crossing fingers that it might help installing that)

    thank you Jakob

    regards Jakob Slight smile

  • 0 in reply to Jakob Agustsson

    Just happy to help! Thank you for additional information about the system. If all 3 VM's are new and all 3 VM's have all the latest windows updates installed, you should not get "Access Denied".

    If you still get it, it could be because of a completely "incompatible" Windows version. At least we have experienced some Windows 11 clients that just does not want to accept a deployment, and had to roll these back to WIN10.

    Otherwise, if your IT department has not disabled or denied the use of any protocols (NTLM, gRPC, DCOM) or applied restrictive security settings, you might have discovered a new problem Slight smile

    I'm also just trying out the new patch, and they usually fix a lot! But let me know how it goes please, as I'm very interested in having a technical explanation to our customers that need an upgrade! Slight smile

Reply
  • 0 in reply to Jakob Agustsson

    Just happy to help! Thank you for additional information about the system. If all 3 VM's are new and all 3 VM's have all the latest windows updates installed, you should not get "Access Denied".

    If you still get it, it could be because of a completely "incompatible" Windows version. At least we have experienced some Windows 11 clients that just does not want to accept a deployment, and had to roll these back to WIN10.

    Otherwise, if your IT department has not disabled or denied the use of any protocols (NTLM, gRPC, DCOM) or applied restrictive security settings, you might have discovered a new problem Slight smile

    I'm also just trying out the new patch, and they usually fix a lot! But let me know how it goes please, as I'm very interested in having a technical explanation to our customers that need an upgrade! Slight smile

Children
© 2024 AVEVA Group Limited or its subsidiaries. All Rights Reserved.